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Security needs spawn services 

Managed detection services growing in popularity. 
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Companiea installing intrusion- detection software to protect their 
networks are faced with this practical question: Do we have the skills and 
time to keep the round-the-clock vigils the software requires ?The 
alternative is going to an outside firm that offers a managed security 
service that can identify denial -of -service attacks or other threats. This 
week, Internet Security Systems [ISS) , which specializes in scanning 
software, and start-up Counterpane Internet Security, will each begin 
offering its own style of managed intruJiion-detection services, 
boosting choice in an underserved area of security .Although companies such 
as UUNET, AT&T and Exodus offer managed firewall services, only a few 
providers, including Pilot Hetwork Services, have ventured to take on what 
is arguably the bigger challenge. And that's monitoring the 
customer's internal servers and network traffic, where some type of 
Intrusion -detection sensors must be deployed to determine if systems 
are under attack. Unlike the new offerings from ISS and Counterpane, 
the Pilot Network Seirvices model reqiaires firms to house equipment at a 
Pilot data center and connect to it by a private line, "We 're doing a 
security monitoring service by putting a probe on the customer's 
network to accept audit data from a wide range of devices," says Bruce 
Schneier, Counterpane * s chief technology officer. Schneier, a leading 
cryptographer, started the company with $7 million in venture-capital 
funding from Bessemer Ventures and other firms .Counterpane 's 
Linux -based "black box" sensor captures syslog and audit outputs from 
Windows NT, Solaris and Ijin\ix servers; routers; security gear such as Check 
Point Software and Cisco Pix firewalls; plus ISS and Tripwire 
intrusion-detection software. The Counterpane box regularly 
transmits the network activity output in encrypted form to 
Countoxpana *e data centers in Mountain View, Calif., or Chantilly, 
Va,, where it is monitored around the clock. "Embedded in this data 
are the footprints of attacks, and our analysts are trained to understand 
them," Schneier says, adding Counterpane staffers advise corporations 
on how to combat threats but do not make changes to the corporation's 
equipment , Santa Clara service provider Conxion, which specializes in 
hosting business -to-business applications for customers including Visa 
International, has started using the Counterpane service, "All our 
critical infrastructure devices report to the counterpane device," 
Bays Conxion security director Mark Kadrich. "We have more than 2 0 
firewalls, we use all the ISS intrusion-detection software, and it's 
hard to find qualified people to analyze this mind-numbing output . "Although 
some may argue that outsoxircing network security management is an 
unacceptable risk, Kadrich - who requires everyone on his staff to earn the 
coveted CISSP security certification - argues otherwise. "Security needs to 
be results-based, and those unwilling to outsource don't really understand 
the problem," he says . Counterpane says its service costs about 
$12,000 per month- ISS, which holds about 60% of the market for 
intrusion -detection software according to market research firm IDC, 
has also recognized the pent-up demand for outsourcing help. "We have 5,500 
customers today, mostly larger firms, but there are literally millions of 
businesses drawn to the Internet for business-to-consumer or 
business-to-businese e - commerce, " says ISS CEO Thomas ^loonan. "For many of 
them, security is important but misunderstood, and many have small IT 
departments. "ISS, which offers six products for network and application 
scanning and vulnerability assessment, has now developed a Managed Security 
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Services plateorro. The offering, based on technology obtained through the 
acouisitlon of a company called Netrex, will enable ISPs and 
telecomm\ini cat ions firms to provide outsourced security monitoring. 
Customers will have to deploy the ISS SafeSuite intrusion-detection 
sensor on their sites to get the security monitoring service .Under 
the plan, ISS will supply security eacperts to work in operation centers at 
ISPs and telecom firms. These experts will monitor corporate routers, 
provide Web-content filtering, and watch Check Point and KatchGuard 
firewalls as well as the ISS intrusion- detection soft ware. According 
to Noonan, Ameritech, AT&T, Etribratel, US West, BellSouth, NTT, Sawie and 
other service providers around the world have signed agreements to use the 
ISS Managed Security Services platform. Corporate customers for this 
so-called ePatrol Service will be given remote access to the same security 
view of their networks as the ISPs and telecom firms will have, Noonan 
says, Some companies are already sold on managed security 
services .ContiGroup Companies, formerly Continental Grain, haB used the 
Pilot managed service for intrusion detection for about a year, 
installing the corporate firewall at Pilot. "We didn't have the staff with 
the expertise for this, and the relationship with Pilot has worked well to 
fight viruses and hacking attempts," says Bill Clark, Internet service 
manager. Counterpane; www. counter pane.com; ISS: www.iss.net 
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